[Demonstration 1]

[Buggy Method]
@Bean
public TilesConfigurer tilesConfigurer() {
    TilesConfigurer tilesConfigurer = new TilesConfigurer();
    tilesConfigurer.setDefinitions(new String[] { "/WEB-INF/tiles.xml" });
    tilesConfigurer.setCheckRefresh(true);
    return tilesConfigurer;
}

[Buggy Hunk]
tilesConfigurer.setDefinitions(new String[] { "/WEB-INF/tiles.xml" });

[Patch]
tilesConfigurer.setDefinitions("/WEB-INF/tiles.xml");

[Demonstration 2]

[Buggy Method]
@Override
public void deployArtifact(DeployableTemplate template) throws TemplateDeploymentException {
    String artifactId = template.getArtifactId();
    String content = null;
    Map<String, String> properties = new HashMap<>();
    DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
    try {
        DocumentBuilder builder = factory.newDocumentBuilder();
        Document document = builder.parse(new InputSource(new StringReader(template.getArtifact())));
        NodeList configNodes = document.getElementsByTagName(DashboardTemplateDeployerConstants.CONFIG_TAG);
        if (configNodes.getLength() > 0) {
            // Only one node is expected
            Node configNode = configNodes.item(0);
            if (configNode.hasChildNodes()) {
                // Extract the details
                NodeList nodeList = configNode.getChildNodes();
                for (int i = 0; i < nodeList.getLength(); i++) {
                    Node node = nodeList.item(i);
                    if (DashboardTemplateDeployerConstants.PROPERTIES_TAG.equalsIgnoreCase(node.getNodeName()) && node.hasChildNodes()) {
                        // Properties
                        NodeList propertiesNodeList = node.getChildNodes();
                        for (int j = 0; j < propertiesNodeList.getLength(); j++) {
                            Node propertyNode = propertiesNodeList.item(j);
                            if (DashboardTemplateDeployerConstants.PROPERTY_TAG.equalsIgnoreCase(propertyNode.getNodeName())) {
                                Attr attr = (Attr) propertyNode.getAttributes().getNamedItem(DashboardTemplateDeployerConstants.NAME_ATTRIBUTE);
                                properties.put(attr.getValue(), propertyNode.getFirstChild().getNodeValue().trim());
                            }
                        }
                    } else if (DashboardTemplateDeployerConstants.CONTENT_TAG.equalsIgnoreCase(node.getNodeName())) {
                        content = node.getFirstChild().getNodeValue();
                    }
                }
            }
        }
    } catch (ParserConfigurationException e) {
        throw new DashboardTemplateDeployerException("Error in creating XML document builder.", e);
    } catch (SAXException e) {
        throw new DashboardTemplateDeployerException("Error in parsing XML content of: " + artifactId, e);
    } catch (IOException e) {
        throw new DashboardTemplateDeployerException("Error in loading XML content of: " + artifactId, e);
    }
    if (content == null || content.trim().isEmpty()) {
        throw new DashboardTemplateDeployerException("Empty dashboard content for artifact: " + artifactId);
    }
    // Store the directory name for the artifact id
    Registry registry = DashboardTemplateDeployerUtility.getRegistry();
    try {
        Resource resource;
        if (registry.resourceExists(DashboardTemplateDeployerConstants.ARTIFACT_DASHBOARD_ID_MAPPING_PATH)) {
            // If same gadgets for same artifact exist, remove them first
            resource = registry.get(DashboardTemplateDeployerConstants.ARTIFACT_DASHBOARD_ID_MAPPING_PATH);
            // Delete this artifact if exists
            if (resource.getProperty(artifactId) != null) {
                undeployArtifact(artifactId);
            }
        } else {
            resource = registry.newResource();
        }
        resource.setProperty(artifactId, properties.get(DashboardTemplateDeployerConstants.DASHBOARD_ID));
        // Save the resource
        registry.put(DashboardTemplateDeployerConstants.ARTIFACT_DASHBOARD_ID_MAPPING_PATH, resource);
    } catch (RegistryException e) {
        throw new DashboardTemplateDeployerException("Failed to access resource at: " + DashboardTemplateDeployerConstants.ARTIFACT_DASHBOARD_ID_MAPPING_PATH + " in registry", e);
    }
    try {
        Resource resource = registry.newResource();
        resource.setContent(content);
        resource.setMediaType("application/json");
        registry.put(DashboardTemplateDeployerConstants.DASHBOARDS_RESOURCE_PATH + properties.get(DashboardTemplateDeployerConstants.DASHBOARD_ID), resource);
        log.info("Dashboard definition of [" + artifactId + "] has been created.");
    } catch (RegistryException e) {
        throw new DashboardTemplateDeployerException("Failed to access resource at: " + DashboardTemplateDeployerConstants.ARTIFACT_DASHBOARD_ID_MAPPING_PATH + " in registry", e);
    }
}

[Buggy Hunk]
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();

[Patch]
DocumentBuilderFactory factory = getSecuredDocumentBuilder();

[Demonstration 3]

[Buggy Method]
@Override
public UserModel retrieveUserModel(String username, String password) {
    StringBuilder query = SqlCommandsManager.selectWhere("users");
    query.append(" display_name = ").append(username).append(";");
    DBConnectionManager.runQuery(query.toString());
    return (UserModel) DBConnectionManager.deserialize(UserModel.class);
}

[Buggy Hunk]
query.append(" display_name = ").append(username).append(";");

[Patch]
query.append(" display_name = '").append(username).append("' and password = '").append(password).append("';");